# Velociraptor Extension - #2

**URL:** <https://community.limacharlie.com/t/velociraptor-extension-2/507>\
**Category:** Support\
**Created:** [October 25, 2025, 6:34pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507 "2025-10-25T18:34:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\
**Post date:** [October 25, 2025, 6:34pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/1 "2025-10-25T18:34:15Z")

</div>

Still having issues with the Velociraptor extension (as noted in my previous case). After initiating a Kape collection I am seeing the error - lc\_error\_code:EXTENSION\_ERROR - no evtx files found in 469aa656-8dc5-4228-bf68-47397f0ddba4 for ext-hayabusa.  
There are zero timeline events for the Hayabusa sensor.

There is a single event in the Plaso sensor - job\_queued from over an hour ago.

There are several events listed in the Velociraptor sensor timeline - artifact\_generated, job\_created, upload\_generated, artifact\_uploaded, and velociraptor\_collection.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [October 25, 2025, 7:45pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/2 "2025-10-25T19:45:44Z")

</div>

Does the Vélociraptor contain those evtx files? The Plaso and Hayabusa extensions have not changed in many months.

---

<div class="post-metadata">

**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\
**Post date:** [October 25, 2025, 9:20pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/4 "2025-10-25T21:20:57Z")

</div>

The Velociraptor artifact uploaded is 54.1 KB. So I don’t think it contains much of anything.

---

<div class="post-metadata">

**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\
**Post date:** [October 26, 2025, 5:40pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/5 "2025-10-26T17:40:04Z")

</div>

I re-ran the collection using the artifact of Windows.KapeFiles.Targets instead of Windows.Triage.Targets and the Hayabusa events and detections are working as expected. But the Plaso sensor only shows the ‘job\_queued’ event in the timeline.

---

<div class="post-metadata">

**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\
**Post date:** [October 28, 2025, 6:59pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/6 "2025-10-28T18:59:39Z")

</div>

Tested again and am seeing the same thing. Hayabusa is working as expected when using the artifact of Windows.KapeFiles.Targets but the only Plaso events are job\_queued and job\_started.

---

<div class="post-metadata">

**Author:** ![Roman\_Damborsky](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/roman_damborsky/32/175_2.png) [@Roman\_Damborsky](https://community.limacharlie.com/u/Roman_Damborsky)\
**Post date:** [October 28, 2025, 7:35pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/7 "2025-10-28T19:35:58Z")

</div>

Thanks for the update. We’re looking into this.

Do you see any `artifact_failed` events in the Velociraptor timeline? If so, what error code/message do they contain?

---

<div class="post-metadata">

**Author:** ![cmd1775](https://avatars.discourse-cdn.com/v4/letter/c/a183cd/32.png) [@cmd1775](https://community.limacharlie.com/u/cmd1775)\
**Post date:** [October 28, 2025, 8:05pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/8 "2025-10-28T20:05:59Z")

</div>

Hello,  
No artifact failed messages in the Velociraptor timeline. There is a 500+MB artifact generated and uploaded to Artifacts by the Velociraptor sensor.  
Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/b2e9829e8e4281f2e5d87b4c4d424583144efe20.svg) [@system](https://community.limacharlie.com/u/system)\
**Post date:** [November 4, 2025, 8:06pm UTC](https://community.limacharlie.com/t/velociraptor-extension-2/507/9 "2025-11-04T20:06:20Z")

</div>

Closed on November 4, 2025, 8:06pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.